Privacy Policy (GDPR)

Data controller: Alberto Gallino (tax code GLLLRT01S26A182I), Via Cordara 32, 15121 Alessandria (AL), Italy, support@packify.cards. This notice describes how we process the personal data of Packify users.

1. Data processed

• Account: email, name, password (encrypted), date of birth, email verification date, the date and version of the Terms you accepted, and your username.
• Public username: the username you choose in the Packify Cup section is shown to other users on the monthly Packify Cup ranking, together with your score for the month. Until you choose one, the ranking shows a generic name. Nothing else about you is public.
• Orders and Coins: Coins purchases, ledger movements (including free rewards claimed), pack purchases and openings, Binder and Collection contents, locked sets.
• Shipping: shipping address (a copy is kept with each shipment), optional phone number (passed only to those who handle the delivery, listed in section 3, for delivery notices), status, tracking.
• Technical: security and audit logs (relevant actions, timestamps), IP address for security and abuse-prevention purposes, and a random browser identifier from a technical cookie (see the Cookie Policy). To enforce one account per person we keep only coded fingerprints of the IP you signed up from and of that identifier, never the values themselves.
• Friend code: if you signed up through a friend's invite link, we record which account invited you, to credit the friend-code reward (see the Coins Terms of Use). The person who invited you only sees how many friends signed up and how many rewards they received, never who they are. If you share your own invite link, the sign-up page it opens shows your username, if you have chosen one. To check that the two accounts do not belong to the same person, we compare the account data listed above (names, addresses, phone, browser identifier and the coded fingerprint of the sign-up network).
• Reviews: after a delivery we may email you a personal link to review it. If you write a review, we may publish it on the site with your username, your rating, your text and the photos you attach and, only if you choose to, your country. Your username and at least one photo of the cards you received are required to receive the review reward. You can ask us to remove your review at any time by writing to support.
• Campaign source (only if you accept the campaign cookie): the labels of our ad campaign that brought you to the site (utm_ parameters), saved on your account when you sign up and counted, together with your Coins purchases, in our internal per-campaign statistics. See the Cookie Policy.
• Meta Pixel (only with consent): pages visited, sign-up, checkout started and Coins purchases (with amount), sent to Meta with your hashed email and account ID, browser identifiers, user agent and, at checkout, IP. See the Cookie Policy.
• If you sign in with Google: the account identifier, email, name and profile picture provided by Google.
• Visit statistics: aggregated counts of page views and visitors (page address without personal parameters, referring site, country, device and browser type), collected without cookies or other identifiers stored on your device. A visitor is recognised only through a hash of the request that is discarded after 24 hours, so the statistics cannot be linked to you or to your account.

2. Purposes and legal bases

• Performance of the contract (sign-up, purchases, shipping, support).
• Legal obligations (accounting, tax).
• Consent (measuring our ad campaigns, and measuring and improving our ads on Facebook and Instagram with the Meta Pixel — optional, withdrawable any time via "Cookies" at the bottom of every page).
• Legitimate interest (platform security, fraud prevention, integrity of the draw mechanism; aggregated, cookieless visit statistics to understand which pages are used and improve the site).

We do not carry out profiling or marketing without separate consent.

3. Providers and other recipients

Providers that process data on our behalf:

• Hosting, cookieless visit statistics and review photos: Vercel (Vercel Inc., USA); the application runs in the Frankfurt (Germany) region.
• Database: Neon (Databricks, Inc., USA), hosted in the EU (Frankfurt, Germany).
• Transactional email: Resend (Plus Five Five, Inc., USA).
• Customer support email: Zoho Mail (EU data centre).
• Payments: Stripe.

Each of them processes data only on our instructions, under a data processing agreement (Article 28 GDPR). Where data leave the European Economic Area, for example to the US companies listed above, the transfer is covered by the European Commission's standard contractual clauses and, where the provider is certified, by the EU-US Data Privacy Framework.

Stripe also processes some payment data as an independent controller, for its own purposes such as fraud prevention and its legal obligations, under its own privacy policy.

Google (only if you sign in with Google): an independent controller for the sign-in, under its own privacy policy.

Meta Platforms Ireland (Meta Pixel, only with consent): joint controller with us for collecting and sending the data; then an independent controller under its own policy, with possible transfers to the US under the EU-US Data Privacy Framework.

Suppliers, marketplaces and couriers: to deliver the cards you ask us to ship, we pass the recipient's name, the shipping address and, if you gave one, the phone number to those who handle the delivery: the courier, when we ship the parcel ourselves; and, when a card we order is sent straight to you, the supplier we buy it from, the online marketplace we order it through and the postal service or courier the supplier uses. They receive only these data, only for your order, and must process them in compliance with the GDPR. If one of them is outside the European Economic Area, for example when the parcel goes to a country outside it, these data are passed on under an adequacy decision of the European Commission where there is one, and otherwise because this is needed to deliver your order (Article 49(1)(b) GDPR).

4. Retention

Account data: for the duration of the relationship and for as long as needed to meet legal obligations. Accounting data: 10 years. Campaign source: until you withdraw consent, and at most 24 months after sign-up. Meta Pixel identifiers saved with your account or an order: until sent to Meta, 7 days at most. Reviews and their photos: until you ask us to remove them or close your account. Security logs: a limited and proportionate period.

5. Rights

You can exercise your rights of access, rectification, erasure, restriction, portability and objection by writing to support@packify.cards. You may lodge a complaint with the data protection authority (in Italy, the Garante per la protezione dei dati personali). Erasing your account also removes you from any past Packify Cup ranking; see the Terms for how the ranking works.